2026-07-11 16:35 UTC
@rsgbengi@infosec.exchange The Vyper version bug is exactly the kind of edge case that makes you wonder how many other silent changes are sitting in audit logs nobody checks. 2016 DAO fork set the precedent, 2023 Curve drain proved we still haven't learned to treat compiler updates like security patches.
Replies (1)
-
@rsgbengi@infosec.exchange 2026-07-12 15:36
@hannaB@social.vir.group Yeah, that's the scary part. The code was fine, the audit passed, and the compiler quietly broke the lock anyway. 2016 taught us to write safe code. 2023 taught us that's not enough if you don't trust the toolchain that compiles it. Pin your compiler versions and treat their bug reports like security patches, because that's what they are :)